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We introduce a novel form of decoy-state technique to make the single-photon Bennett 1992 
protocol robust against losses and noise of a communication channel. Two uninformative states are 
prepared by the transmitter in order to prevent the unambiguous state discrimination attack and 
improve the phase-error rate estimation. The presented method does not require strong reference 
pulses, additional electronics or extra detectors for its implementation. 



PACS numbers: 03.67.Dd, 03.67.Hk 

I. INTRODUCTION 

Quantum Key Distribution (QKD) is a way to dis- 
tribute secret keys between two distant parties with prov- 
able security P, 0, S 0] • Despite the general principles of 
QKD are now well known, there is no definite answer yet 
about its effective use in the real world, being it depen- 
dent on practical figures of merit like the transmission 
rate, the working distance and even the production cost 
of a specific implementation. A useful criterion in such 
intricate situations is that of the simplest choice. In case 
of cryptography this is particularly desirable for it allows 
general and reliable security proofs together with efficient 
and low-cost practical realizations. 

The simplest QKD protocol was conceived by C. H. 
Bennett in 1992 and named after him "B92" @]. It 
is based on only two nonorthogonal states associated 
with the two values of the logical bit to-be-secretly- 
transmitted. Despite its simplicity, the B92 is considered 
as a quite impractical protocol, mainly for its low toler- 
ance to the losses and noise of a communication chan- 
nel Q. The high dependance on channel losses can be 
ascribed to the so-called Unambiguous State Discrimi- 
nation (USD) attack Q, which represents the principal 
threat against the B92, and severely limits its perfor- 
mances. On the other side, the high dependance on the 
channel noise can be imputed to the lack of a direct 
phase-error estimation, which entails a more than nec- 
essary privacy amplification as soon as the noise sensibly 
increases. 

So far, no solution has been devised to improve the 
phase-error estimation of B92, and only one solution is 
available to contrast the USD attack. It was originally 
proposed inH , and recently proved unconditional secure 
in and j9|. It consists of a strong reference pulse ac- 
companying the signal pulse and phase-related to it. The 
presence of the reference pulse prevents an eavesdrop- 
per (Eve) from selectively stopping the signals according 
to the results of an USD measurement. By adopting 
the technology reported in [T(J, this solution would al- 
low a secure QKD over distances of about 124 Km Q. 



However the high intensity of the reference pulse is ex- 
pected to cause in practice noise due to the scattering 
inside an optical fiber [Til ], while if a weaker reference 
pulse is used [l2Tj , the maximum distance drops to about 
87 Km. Furthermore the solution of a strong reference 
pulse cannot be applied if the B92 is realized with a 
single-photon source or with SPDC (Spontaneous Para- 
metric Down Conversion), because the beam intensities 
cannot be modulated to the necessary extent. On the 
contrary, a solution functioning at the single-photon level 
could be at once transferred to a realistic scenario by 
virtue of the decoy-state technique [HI, [T3, [TB] , which al- 
lows the estimation of statistical quantities related to the 
single-photon pulses only. 

In this paper we propose a novel solution to make the 
single-photon B92 robust against the losses and the noise 
of a communication channel. First, the transmitter pre- 
pares, besides the two conventional signal states, two ad- 
ditional uninformative states. This modification alone is 
very feasible and allows to detect the USD attack. The 
protocol containing this first modification will be called 
B92 henceforth. In contrast to the state-of-the-art, the 
gain [TH of the single-photon B92 depends only linearly 
on the loss rate of a communication channel rather than 
nearly quadratically. This result is anticipated in Fig. [T] 
As a second step, the receiver's box is slightly modified 
so to directly measure the phase-error of the B92, whose 
estimation is known to be quite poor at large angles be- 
tween the two signal states. The protocol containing both 

the first and the second modifications will be called B92. 
This further variant provides a higher tolerance to the 
channel noise, approaching, when the two signal states 
are nearly orthogonal, the one featured by the BB84 [ljj • 
The main achievement of the paper is the formula- 
tion of the B92. It relies on the observation that the 
states of B92, being only two, are always linearly inde- 
pendent. Since the USD attack is effective only on sets 
of linearly independent states [l~8l | , it is quite natural to 
introduce one more state to obtain a set of linearly de- 
pendent states. This removes at the root the possibility 
of an USD attack. Actually the states added in the new 
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FIG. 1: (color online) Plots of the secure gain G as a function 
of the channel loss rate L, for the standard B92 (black circles) 
and for the B92 (red circles). The B92 scales linearly with 
L, while the B92 scales nearly quadratically, and ceases to 
provide a positive gain at about L = 0.6. The curves are 
drawn assuming a depolarizing channel with p = 0.01 (see the 
text). On the top-right, the states of traditional B92 (black 
arrows) and the extra uninformative states (red arrows) used 
in the two modifications of the B92 (see the text). 

protocol are two rather than one; this depends on tech- 
nical reasons related to the unconditional security proof 
which will become clear later. The added states are un- 
informative and after the quantum transmission are dis- 
carded. Even so the users can measure the loss-rate per- 
taining to these states and obtain a signature of Eve's 
presence. This solution resembles the decoy-state tech- 
nique [H, UH EH used to realize a long-distance BB84 in 
a realistic scenario; so we will call the extra uninforma- 
tive states "decoy states" henceforth. However it should 
be noted that the conventional decoy-state comes from 
the intensity modulation of a certain pulse, i.e. from the 
modulation of a degree of freedom different from the one 
in which information is encoded; on the contrary, in the 
present case, the decoy-state is encoded in the same de- 
gree of freedom of the signal states, and there is no mod- 
ulation in other degrees of freedom different from that. 
This is a relevant peculiarity of the B92 since it entails 
that no additional hardware respect to a standard B92 
setup is required to implement the new protocol. 

In the next, we focus on the B92, leaving the B92 for 
the conclusion of the paper. It should be noted however 
that all the results obtained for the former protocol, in 
particular its unconditional security, hold for the latter 
protocol as well; so they will be given without repeating 
unnecessary security proofs. 

Our work is structured as follows: in Section |TT] we 
briefly review the security proof of the standard B92, 
to intuitively explaining the idea of using uninformative 



states to protect against the USD attack. Then, in Sec- 
tion lllli we introduce the B92 and provide the proof of its 
unconditional security. In Section llVI we show, with the 
help of numerical simulations, the independence of the 
new protocol from the losses of a communication chan- 
nel. In Section [V] we detail the B92, in which the users 
perform a direct estimate of the phase-error rate. The 
concluding remarks are given in Section [VT1 

II. PRELIMINARY CONSIDERATIONS 

Let us introduce the notation to explain the B92 
protocol. We write the bit encoded by the transmit- 
ter (Alice) as j = {0, 1} and the corresponding qubit 
as \ip ) = /3|0 X ) + a\l x ), where {|0 X ) , \l x )} are 

the eigenstates of the X basis, (3 = cos|, a = sin|, 

< 9 < ir/2 (see FigflJ. The bases X and Z are related 
by \j z ) = [\0 x ) + (-iy\l x )]/V2. We can also intro- 
duce the state |^-) = a\0 x ) — (— iy/3\l x ) orthogonal to 

It is possible now to define a general USD measure- 
ment, parametrized by 7, as M"g g2 = {F^ , , F? nc , F v }, 

withF 7 = fo) fol), F? = \7p ) & \),Fl c = 

1 — Fq — F^ , F v — \v) (v\; \v) is a state that includes both 
vacuum and multi-photon pulses, whose occurrences de- 
pends on L, the total loss-rate of the communication 
channel, which is under Eve's control. It is maybe use- 
ful to point out that the operators Fq , F^ and F? nc live 
in the subspace characterized by the single-photon pro- 
jector n s , while F v lives in the complementary subspace 
1 — n s . Note that we are assuming for simplicity a per- 
fect single-photon source for Alice and ideal detectors 
for Bob. More precisely Bob's detectors can discrimi- 
nate vacuum, single-photon and multi-photon pulses, and 
they are modeled like a beam-splitter with transmission 
r/B, controlled by Eve, followed by detectors with unit 
efficiency. The control by Eve on detectors is taken 
into account by including rjg in the loss-rate L. We 
remark that the assumption of a perfect single-photon 
source can be dropped if the standard decoy-state tech- 
nique [HI, 0, [H[ is brought into the description. Also, 
we define for later use F c 7 onc = (F 7 + F?) = (A] i; ) 2 , and 
we include in the term "vacuum" both the vacuum and 
the multi-photon events. Finally, we observe that the 
measurement -M]j g2 is optimal when 7=1, while it is 
practical when 7 = (3 [19j . While the receiver (Bob), 
due to his limited technology, can execute just the prac- 
tical measurement -Mg 92 , Eve is supposed to be endowed 
with superior technology, so she can execute the optimal 
M 

B92> with even the additional condition L — 0. In fact 
we conservatively assume that Eve completely controls 
the channel, so all the losses and noises are caused by 
her. 

The unconditional security of a lossless B92 was proved 
for the first time in [2(j and that of a lossy B92 in [2l| . 
It is shown there that the Prepare-and-Measure (PM) 
B92, experimentally accessible to Alice and Bob, can be 
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obtained through a reduction argument by another pro- 
tocol based on Entanglement Distillation (ED) [22). The 
ED protocol is not really implemented by the users; it 
is rather a theoretical tool to find the conditions under 
which the B92 operations can lead to the distillation of 
the maximally entangled state 
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which explicitly contains the two signal qubits. 

The reduction from the ED to the PM protocol is ob- 
tained by noting that the measurement -M B92 effected by 
Bob in the PM protocol is equivalent in the ED protocol 
to a Z-basis measurement conditional on the successful 
filtering operations Q v = {F v , 1 — F v } and A^ a . In par- 
ticular, when the filters are successful, the Bell state ([1]) 
is obtained with probability 2a 2 /? 2 by the state (J5J), if 
the channel is lossless and noiseless J23|. Once the users 
share the state ((T|) they can obtain a secure key by the 
subsequent measurement in the Z basis. 

Nonetheless, in real situations, the channel is not 
lossless and noiseless, so the filtered states may 
include nut bit errors, represented by the states 
{\0z)a\^ z )bA 1 z)a\0 z )b}, and n ph phase errors, repre- 
sented by the states {|0 X )^|1 X ) B , \1 x }a\0 x )b}- Alice 
and Bob must then resort to an ED based on CSS 
codes 0, HH in order to correct the errors and distill 
the Bell state (Q}. This procedure needs not to be ac- 
tually accomplished by the users; it suffices that they 
provide reliable upper bounds to the number of bit er- 
rors and phase errors present in their data. This is the 
main breakthrough of the security proof given in [J] . 

Bit errors can be directly estimated by sacrificing a 
part of the data, which are publicly revealed on the clas- 
sical channel. On the contrary phase errors can not be di- 
rectly estimated in B92. This is due to the fact the none 
of the operations of this protocol can be made equiva- 
lent to a measurement in the X basis. To cope with 
this problem, it is useful to devise a gedanken experi- 
ment in which Alice and Bob perform a measurement of 
the state (|2|) in the X basis. In this way the gedanken 
outcomes can be put in relation with measurable quan- 
tities of the protocol. Let us indicate with \i x ) a\]x) b 
(i = {0,1}, j = {0,1,?;}) the gedanken outcomes, and 
with tl i j the number of their occurrences. Then, by look- 
ing at the second of Eqs.@, and by considering Bob's 
measurement -A4 B92 , we can easily obtain the following 
relations, valid in the asymptotic limit of large N [2p|.[2l1|: 



n ph = (3 n 01 + a n w , 
a 2 N = ?7io + "-li + niv ■ 



(3) 
(4) 



Eq. ([3]) quantifies, in terms of gedanken quantities, the 
number of phase errors; it contains tt-oi and nio which can 
be put in relation to measurable quantities through an ar- 
gument based on quantum theory [2(| • Eq. ^ is a direct 
consequence of the fact that neither Eve nor the channel 
can access Alice's qubit as long as it is in Alice's hands; it 
contains the crucial parameter ni v , which quantifies the 
effective nonorthogonality of the signal states in presence 
of losses. In fact, consider the case of a lossless channel, 
i.e. n\ v = 0. From Eq.([¥]) we can see that the quantity 
A = 7710 + measures the degree of nonorthogonality 
of the two signal states, being it equal to a 2 N, and be- 
ing 1 — 2a 2 equal to the scalar product of the two signal 
states. When losses are taken into account, A still repre- 
sents the nonorthogonality of the two states on a loss-free 
channel, but this time it is equal to a 2 N — ni Vl smaller 
than before. This means that losses have increased the 
orthogonality of the two states, making the B92 more 
prone to USD and other loss-based attacks. So it is im- 
portant to include ni v in the phase estimation process, 
for its optimization is directly related to the amount of 
information leaked to Eve through a loss-based mecha- 
nism. By executing the numerical search of the phase 
error upper bound, it turns out that the optimal value 
for n\ v is zero in most of the cases. Below, we show that 
it suffices to consider the USD attack to intuitively ex- 
plain this value. 

The USD attack is performed by Eve via the optimal 
measurement M B92 i executed on the qubits prepared by 
Alice. Let us consider the signal states {\fo) > and 
the X-basis states { |0^) , ll^)}. A conclusive outcome is 
obtained by Eve for these four states with the following 
probabilities: 
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If the result is conclusive, Eve forwards the qubit (in the 
correct state) to Bob; otherwise she stops the qubit and 
creates a loss in the channel. So, while in case of no attack 
the four states are expected to arrive at Bob's detectors 
with the same probability, in case of USD attack, the 
users would detect N s (l — cos 8) signal states, Nd states 
\l x ) and states |0 X ), where N s and Nd are respectively 
the total number of signal and decoy states prepared by 
Alice. Note that this implies in case of USD attack the 
following setting: 



0. 



(7) 



In standard B92 the users can not measure the loss-rates 
of Eq.©, so they conservatively assume that Eve exe- 
cuted an USD attack even if she actually did not, whence 
Eq.©. But the loss-rates of Eq.© become measurable 
in B92, because of the presence of two uninformative 
states which are chosen on purpose equal to 10^) and 
\l x ). This is the main feature that makes the new proto- 
col independent of losses. 
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III. PROTOCOL AND UNCONDITIONAL 
SECURITY 

In the B92, Alice prepares the two signal states 
{\<Po) , \fi)} pl us two additional uninformative decoy 
states {\ipd) 7 which are chosen respectively equal 

to the states {|la;) , 10^)}. Here we consider two decoy 
states only, but the use of three or more decoy states 
could be useful to adverse other kinds of USD-based at- 
tacks, like those described in [26|, [28[. Notice that the 
addition of two decoy states makes the overall states pre- 
pared by Alice linearly dependent; hence is impossible for 
Eve to unambiguously discriminate them. More impor- 
tantly, the presence of two decoy states, prepared with 
suitable probabilities, makes the signal and decoy density 
matrices identical. This is fundamental for the uncondi- 
tional security proof of the protocol, because it prevents 
Eve from behaving differently with signals and decoys, 
and legitimates the use of random sampling arguments 
between the two classes of pulses prepared by Alice. Let 
us write explicitly the density matrix of the signal states: 

P = (lw>)(Vo| + IVi)(¥>i|)/2 

= P 2 |0 X ) (0 X \ +a 2 \l x ) (1,1. (8) 

The above equation explains why we chose the decoy 
states equal to the A-basis states {\l x } , \0x)}- More- 
over, the requirement of equal density matrices for signal 
and decoy states fixes the preparation probability of the 
states Ha,) (i.e. \(fd)) and \0 X ) (i.e. \(fd')) respectively 
to a 2 and f3 2 . After the whole quantum transmission 
the decoy instances are discarded. Even so, they allow 
the direct estimate of the crucial quantity n± v previously 
introduced. 

For the security proof of B92 we adopt the same ar- 
gument as in [2l|: we introduce below the PM B92 and 
show that it can be obtained by an ED protocol through 
a reduction argument. Then we show the unconditional 
security of the ED protocol by applying it to a Shor- 
Preskill security proof Q ■ 

PM B92 - (i) Alice randomly and uniformly prepares 
2N signal qubits in the state \<fo) or \<pi), a 2 N decoy 
qubits in the state \ipd) and (3 2 N decoy qubits in the 
state \fd'}- ~ (h) Bob executes the measurement ■Mgg 2 : 
in case he obtains \v) he labels the outcome as 'vacuum'; 
in case he obtains \(po) or \tp\) he labels the outcomes 
as 'inconclusive'; in case he obtains |^ ) (1^)) he labels 
the outcome as 'conclusive' and decodes as T' ('0'). 
(iii) After the quantum transmission, the users randomly 
permute their bits. Then Bob tells Alice the positions of 
vacuum, inconclusive and conclusive counts. Alice cal- 
culates the number n^ v of joint occurrences {f^,) , \v)} 
(k = {0, l,d, d'}) between her preparation and Bob's 
measurement, the number n v = J2k n kv of total vacuum 
counts, and the number n conc of conclusive counts. She 
announces the estimated quantities to Bob together with 
the positions of decoy bits. - (iv) The data correspond- 
ing to decoy or inconclusive outcomes are removed by the 



users. - (v) The first half of the remaining bits (check 
bits) are used for estimating the number of errors n err in 
which Alice prepared \tpo) (\ipi)) and Bob decoded as '1' 
('0'). - (vi) From n v , n err , n conc , and ridv the users esti- 
mate the number of bit errors nut , and an upper bound 
on the number of phase errors n p h in the second half of 
the remaining bits (data bits). - (vii) The users perform 
error correction and privacy amplification on the data 
bits according to the values of nut and n p h respectively, 
thus obtaining an n^-bit shared secret key. 

In the following we provide the ED protocol that we 
show to be unconditionally secure, and that will eventu- 
ally reduce to the PM B92. 

ED B92 - (i) Alice prepares 3A copies of the bipar- 
tite state given in Eq.@ and sends the 3 A systems B 
to Bob over the quantum channel. - (ii) Alice and Bob 
randomly permute by public discussion the positions of 
all their pairs. - (iii) Bob performs the QND measure- 
ment described by Q v = {F v , 1 — F v }, and publicly an- 
nounces the outcomes (29| ; let n v be the number of out- 
comes associated with F v . - (iv) For the first N pairs 
(decoy pairs), Alice measures system A in the X basis, 
and publicly announces the positions of the decoy pairs. 
Since neither Eve, Bob nor the channel can touch Alice's 
qubits, we can infer from Eq.([2]) that she will obtain |0 X ) 
with probability 1 and jl^) with probability a 2 . Alice 
counts the number m v of joint occurrences { 1 1^) , F v } in 
the outcomes. Then the users discard these results. - 
(v) For half of the remaining pairs (check pairs), Alice 
measures system A in the Z basis, and Bob performs the 
measurement -Mg 92 on n ^ s system. By public discussion, 
they determine the number n err of errors in which Alice 
found '0' ('1') and Bob's outcome was '1' ('0'). - (vi) 
For the other half of the remaining pairs (data pairs), 
Bob performs the filtering A^ u on each of his qubits, and 
announces the positions and the total number n fu of the 
qubits that have passed the filtering. - (vii) From n v , 
n err , nfu and n\ v the users estimate an upper bound for 
the number of bit errors nut and phase errors n p h , in the 
nfu pairs. - (viii) They run an ED protocol that can 
produce nk e y nearly perfect EPR pairs if the estimation 
is correct. - (ix) Alice and Bob each measures the EPR 
pairs in Z basis to obtain an nfc ej( -bit shared secret key. 

The unconditional security of our protocol follows the 
proof given in [2l[ after minor modifications. Actually, all 
the operations and measurements in our entanglement- 
based protocol, with exception of Step (iv), are purposely 
chosen equal to [2l| to maximally exploit the results ob- 
tained there. 

The first step is to show the equivalence of the two pro- 
tocols given above. For that, it suffices to note that Eve 
can not distinguish the preparation of the decoy states 
{\<Pd) > \ fd')} m the PM protocol from that of { 1 1^) , |0 X }} 
in the ED protocol, effected through a X basis mea- 
surement, since the resulting states are the same, they 
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are prepared with the same probabilities and the time 
at which Alice performs the X basis measurement can 
not have an influence on the results. This also implies 
that the quantity ridv of the PM protocol corresponds to 
the quantity n\ v of the ED protocol. For the same rea- 
son Eve cannot distinguish the preparation of the signal 
states in the PM protocol from that in the ED one. Fur- 
thermore, from the definitions of F@ onc and A^ u , it can 
be easily seen that the sequence of filters {(1 — F V ), Aj U } 
is equivalent to the operator F@ onc measured with a per- 
fect detector. This also implies that the quantity n conc 
of the PM protocol corresponds to the quantity rifu of 
the ED protocol. 

Regarding the security of the ED B92, the only point 
that deserves some care is the estimation of the quantity 
n\ v by means of the decoy states. In particular we must 
show that this estimation is exponentially reliable. For 
that we take inspiration from the estimation of the bit- 
error rate, which follows closely the standard B92 [20l.l2lj|. 
The number nut of bit errors in the data pairs can be de- 
duced from the number n err of errors in the check pairs 
obtained in the above ED-B92, Step (v). The argument is 
that in order to obtain n^t , Alice and Bob should perform 
Z basis measurements on the data pairs. Despite these 
measurements are not really performed on data pairs, 
they are performed on the check pairs. This is because 
the measurement -Mg 92 is equivalent to a Z measure- 
ment conditional on the outcome (1 — F v ) of Q v and on 
the successful filtering Aj a . Since in Step (ii) all the pairs 
are randomly permuted, the check pairs can be seen as 
a classical random sample of all the pairs remained after 
Step (iv). This leads to the inequality | < Ne 

which is exponentially reliable for large N. 
We can apply the same argument to the decoy pairs. In 
order to obtain m v Alice and Bob should perform X 
basis and QND measurements on their data pairs. Al- 
though these measurements are not really performed on 
data pairs, they are performed on decoy pairs in Step 
(iv) of the ED protocol. Then, because of the random 
permutation of Step (ii), the decoy pairs can be regarded 
as a classical random sample of the 37V pairs prepared by 
Alice. Hence we obtain that the estimation of i%i v in our 
modified B92 is exponentially reliable and can be used 
in the numerical optimization of the phase-error upper 
bound. In the next Section we will show the practical 
advantages of such a direct estimation. 



IV. NUMERICAL SIMULATIONS 

To see the practical advantages of the B92 consider a 
channel with total loss rate L. If there is no eavesdrop- 
ping in the line it is natural to expect (see Eq.Q) that: 



a 2 NL. 



(9) 




i<<Po i <Pi >r 



FIG. 2: (color online) Relative phase-error upper-bound A p h 
(top diagram) and secure gain G (bottom diagram) of the 
B92 versus the squared scalar product of the two signal states 
|(<po|<Pi)| 2 , for channel transmission v — {0, 10, 20, 30} dB and 
depolarizing rate p = 0.01. The vertical dotted lines at 0.322 
(9 = 55.4°) and 0.538 (9 = 42.8°)_mark respectively the max- 
imum of G and the minimum of A p h . 



the contrary, as already mentioned, Alice and Bob can 
by no means verify Eq.@ in the standard B92, so they 
must choose n\ v = 0, according to the worst-case scenario 
described by Eq.([7|). 

The settings of Eqs.®,© lead to the two curves of 
Fig.l, which represent the gain G as a function of the loss 
rate L for the traditional B92 and for the B92. The gain 
is given by G = rifu[l - h(nut/rifu) - h(n p h/rifu)], 
where n p h is the phase-error upper-bound, and h is the 
Shannon entropy [30| . The curves are drawn assum- 
ing, as in [2l| . a depolarizing channel with losses p — ► 

L(l - p) \V) (V\ + (1 — L) [(1 - p)p + V , , ( . (aipcn)] , 

where \V) is the vacuum state, <ii are the Pauli matri- 
ces and p, taken equal to 0.01 in our simulations, is the 
depolarizing rate. The plot pertaining to the B92 is re- 
lated to Eq.@; on the contrary that pertaining to the 
standard B92 comes from Eq.©, and contains the same 
results given in [2l[ for a B92 on a lossy channel. From 
the two plots is apparent that our technique leads to a 
linear decrease of the gain with the loss rate of the chan- 
nel, rather than that, nearly quadratic, of the standard 
B92. Only for L = the standard B92 features a higher 
gain. This is due to the presence of decoy states that go 
discarded in the B92. 

For the lossy depolarizing channel given above, the bit- 
error rate can be easily found to be equal to (1 — L)p/3, 
while that of filtered states is (1 — L)\Ap + 3 + (4p — 
3) cos(20)]/12; hence their ratio, i.e. the relative bit- 
error rate, is independent of losses. In the B92 even the 



Eq.© can be experimentally verified in the B92; this 
represents the main advantage of the new protocol. On 
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upper-bounded relative phase-error, A p ^ 
independent of losses. This can be realized by observing 
the top diagram of Fig. [21 where we plotted A p h ver- 
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sus the squared scalar product of the two signal states, 
| ((fo\ipi) | 2 , for several values of the total transmittancc 
77 = 1 — L. The points pertaining to different values of 
the transmittance follow all the same curve, thus demon- 
strating the independence of A p h from losses. 
From the bottom diagram of Fig. [5J containing the gain 
as a function of | (<po\ipi) | 2 , we can learn that, regard- 
less of the transmittance, the maximum gain is obtained 
when the two signal states are separated by an angle 
9 ~ 55.4°, while the minimum phase-error upper-bound 
is obtained when 9 ~ 42.8°. This is in sharp contrast 
with the standard theory of B92 [2l]],[l2]> which assigns 
very small values to 9 to prevent the USD attack, thus 
reducing substantially the final rate. 

Since the relative bit-error and phase-error rates are 
loss-independent, we can use the results of the lossless 
B92 [2(| to give an estimate of the single-photon B92 
working distance when practical devices are taken into 
account. It is found in [20l ] that the maximum depo- 
larizing rate p* for which the gain of the lossless single- 
photon B92 is still positive is p* = 0.033. In real ap- 
paratuses, the depolarizing rate is given essentially by 
detectors dark counts, which become dominant when the 
quantum signal becomes too low. In [ic| the dark count 
probability is pdark = 1.7 x 10 -6 , the attenuation of the 
fiber is £ = 0.21 dB/Km, the mean detectors efficiency 
is 0.045 and the single-photon detection probability is 
p s (l) = 0.045 x 10~^ /10 , with I the distance between 
the users. From the inequality p = Pdark/Ps(l) < P* we 
can easily obtain a working distance equal to about 140 
Km. This value can be compared with the ones achieved 
by other protocols under similar circumstances. For ex- 
ample it is known that the maximum depolarizing rate 
of BB84 is p* = 0.165 [J], which implies a working dis- 
tance of about 173 Km, while that of SARG04 [3l|] is 
p* = 0.080 [13] with a corresponding distance of 158 Km. 
The difference between the protocols depends crucially 
on their tolerance of the channel noise, as exemplified 
by the above values of the depolarizing rate. One way 
to make a protocol more tolerant to noise is to improve 
its phase-error rate estimation. We accomplish this task 
in the next section by slightly modifying the measuring 
apparatus of the receiver Bob. 



V. IMPROVED PHASE-ERROR ESTIMATE 

With reference to the above-described ED protocol, 
in order to directly measure n p h, Alice and Bob should 
perform X basis measurements on their data pairs, and 
publicly compare their results on the classical channel. 
However in this way their data pairs could be no more 
used to distill a secret key, so this procedure is usually 
substituted by the estimation of the phase-error on a sub- 
sampling of the data pairs, the check pairs, which are 
representative of the whole sample. This is what happens 
in the BB84 for example [3, E3 ■ Nevertheless such an 
estimation procedure cannot be done in the standard B92 



and neither in our modified version B92. The reason is 
that although Alice prepares with a certain probability 
the states in the X basis, i.e. the decoy states, Bob 
never measures them in the X basis. By consequence, 
even in B92 the phase-error can not be directly estimated 
and must be indirectly upper bounded from the values 
of other quantities like n v , n err , nfu and ni„, through a 
numerical optimization algorithm. 

As already mentioned, it is possible to further mod- 
ify the B92 to introduce such a direct estimation of the 
phase-error rate, and make it more resistant to noise. 
The resulting protocol is the B92. It consists in a random 
switch of Bob's measurement between the an< ^ a 

measurement in the X basis. From the instances related 
to the X basis measurement the users can obtain a direct 
estimation of the phase-error of the channel, as it hap- 
pens in the BB84. So, in particular, this is achieved by 
modifying the following Steps of the given PM protocol: 
(ii') Bob executes the measurement A4^ g2 with probabil- 
ity 1/2 and the measurement in the X basis with proba- 
bility 1/2 and takes note of outcomes; [-]. 
(iii') After the quantum transmission, Bob tells Alice the 
positions of vacuum, conclusive and inconclusive counts 
and those of his measurements in the X basis; [—]. She 
announces the estimated quantities to Bob together with 
the positions and the values of decoy bits. All the in- 
stances in which Alice prepared signal states and Bob 
measured in the X basis are discarded. 
(iv') Bob estimates the number of errors n p h in the de- 
coy instances in which Alice prepared \l x ) (|0 X )) and Bob 
detected \0 X ) (\l x )); [-}. 

(vi') From n err the users estimate the number of bit er- 
rors nut- 

The slight increase in the complexity of Bob's mea- 
surement, and the decrease in the final rate entailed by 
the new Step (iii'), are compensated by the benefits of 
a better tolerance to the channel noise. By assuming 
again a depolarizing channel, it can be easily seen that 
the tolerable depolarizing rate p* depends directly on the 
angle between the two signal states: the greater 9 the 
larger p* . This is summarized in Table |TJ It can be seen 



e 


10° 


20° 


30° 


40° 


50° 


60° 


70° 


80° 


90° 


p*%) 


0.4 


1.5 


3.4 


5.9 


8.6 


11.5 


14.0 


15.8 


16.5 



TABLE I: The maximum depolarizing rate tolerable by the 
B92, and the corresponding angle 6 between the two signal 
states. The depolarizingrates for BB84_Jl7| and SARG04 [3J 
are respectively 16.5% and 8.04% [ifT^ 

that the tolerable depolarizing rate can be increased up 
to the BB84 level, and well above the SARG04 thresh- 
old. However we note incidentally that a similar solution 
for a direct phase-error estimation can be applied to the 
SARG04 protocol by modifying only its classical data 
processing. Let us also notice that the unconditional se- 
curity of the B92 follows closely that of the B92; in fact 
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the decoy instances are used as a classical sampling to 
provide an exponentially reliable bound to the phase er- 
rors. 

VI. CONCLUSION 

In conclusion we have shown that a pair of uninforma- 
tive states can be introduced in the single-photon B92 
protocol in order to remove its high dependance on the 
losses and noise of a communication channel. In particu- 
lar, without modifying the receiver's box, the technique 
can prevent at the root an USD attack by Eve. Further- 
more, with a slight modification of Bob's measurement, 
the technique allows a direct estimation of the number of 
phase errors, thus increasing the robustness of the proto- 
col against external sources of noise. 
The results are of theoretical interest since they solve at 
the root the long-standing problem of the unambiguous 
state discrimination of the two single-photon B92 signal 
states. In fact, other protocols based on similar princi- 
ples could benefit of our analysis [H, HH ■ Furthermore, 



although the results arc limited to the single-photon case, 
they are easily exportable to a realistic scenario by apply- 
ing the well established decoy-state technique flU lid fla| . 
The presented method can be extended to more than 
two uninformative states, with the potential of diverting 
other USD-based attacks [IB, H3, HH i possibly related to 
a non-ideal equipment of the users. Another option is 
to adapt the proposed solution to the B92 with a not-so- 
strong reference pulse [l2j ; this would allow to use in that 
protocol a wider angle between the signal states, thus re- 
ducing the problem of a precise phase stabilization. 
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